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Abstract 

The modern advanced avionics In new high- 
performance aircraft strains the capability of 
current technology to safely monitor these systems 
for flight test prior to their generalized use. 

New techniques are needed to Improve the ability 
of systems engineers to understand and analyze 
complex systems In the limited time available 
during crucial periods of the flight test. The 
Dryden Flight Research Facility of NASA's Ames 
Research Center Is Involved In the design and 
implementation of an expert system to provide 
expertise and knowledge to aid the flight systei. s 
engineer. This paper discusses the need *or new 
techniques In monitoring flight systems ' the 
conceptual design of an expert-system 
status monitor. The status of the current project 
and Its goals are described. 

Nomenclature 

AFTI advanced fighter technology Integration 

DFCS digital flight control system 

FCC fire control computer 

FCS flight control system 

FSH forward-swept wing 

H1MAT highly maneuverable aircraft 

technology 

LVD' linear variable differential 

transducer 

RCVD remotely controlled vehicle and 

display 

SMS stores management set 

WATR Western Aeronautical Test Range 

Introduction 

The increasing complexity of modern high- 
performance aircraft systems requires Innovative 
techniques to allow the flight test community to 
safely and effectively test these systems prior 
to their generalized use. These complex systems 
are often crucial to flight safety and require 
teams of engineers In a ground control station 
for analysis and monitoring. These systems range 
from new and unusual aircraft, such as the X-29 
forward-swept wing (FSW) aircraft, through advanced 
avionics and flight control systems (FCS), as In 
the advanced fighter technology Integration (AFTI) 

F -16 aircraft, or advanced wing design and control. 


•Aerospace engineer. 

••Aerospace engineer. Member AIAA. 


as on the AFTI/F-111 or F-8 oblique wing aircraft 
(Fig. 1). Each of these advanced system concepts 
are Intensively flight tested (Incurring extensive 
costs and time expenditures) prior to their use 
In a production environment. Current techniques 
available to engineers Involved In flight testing 
Include monitoring aircraft analog parameters 
(on strip charts and CRT displays) and discrete 
Information, such as system status and failure 
Identification (on simple CRT displays or light 
boards). Engineers Involved In monitoring test 
flights are required to have a complete knowledge 
of the system they are monitoring and an ability 
to identify critical events as they occur. In 
the brief time allowed during critical flight 
test events. In high-stress situations. It Is dif- 
ficult for any Individual or group of Individuals 
to always corractly identify and rectify. If 
necessary, problems that often occur on new 
advanced systems. 

A major concern in advanced high-performance 
aircraft systems Is the digital flight control 
system (DFCS). New high-performance aircraft 
are often substantially unstable and require 
augmentation from a full-time, ful 1-authw ’Ity 
FCS. The complexity of a control system retired 
to control the unstable aircraft and improve 
mission performance dictates that the FCS be a 
digital computer. As DFCSs become essential, 
monitoring becomes more critical. Problems that 
occur In the DFCS can cause the loss of an air- 
craft, the abortion or cancellation of a flight, 
or forced modification of the flight test. Fast 
and Informative displays of the status and health 
of the DFCS can save a flight, a mission, or the 
aircraft Itself- Currently established flight 
test monitoring technology Involves discrete 
data transmitted from the aircraft and displayed 
on CRTs or light panels with little. If any. 
Interpretation. 

Figure 2 illustrates the levels of flight 
monitoring automation Involved In evaluating 
and correcting the status and health of DFCSs. 
Level 1 Is early systems monitoring with primi- 
tive capabilities, which Involved Immense light 
panels displaying the discrete Information with 
no interpretation or evaluation, as used in the 
early highly maneuverable aircraft technology 
(HI MAT) program. The systems engineer who moni- 
tored the flights was required to monitor over 
100 lights, determine the status and health of the 
FCS, and recommend the correct action required to 
improve the crisis situation. Level 2 Is the 
current level of flight monitoring In which some 
logical operations are performed on the discrete 
Information downlinked from the aircraft; however, 
no Interpretation Is available, and the systems 
engineer must still determine the DFCS status and 
health from multiple discrete Information displays 
on a CRT. Both the AFTI/F-16 and X-29 aircraft, 
with their complex DFCSs, are currently at this 
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level of automation In systems monitoring. The 
systems engineer still must assemble all the 
Information, determine the status and health of 
the DFCS, and recommend the best procedures to 
resolve discrepancies; these functions are all 
performed In a high-stress environment, In an 
extremely limited time frame, and with very little 
easily accessible Information other than that 
remembered at the time. For safety, current DFCSs 
contain backup systems that relieve some pressure 
from the monitoring systems engineer. 

Level 3 requires a system that Interprets 
the data, automatically provides this 1nfo r mat1on 
to the monitoring systems engineer, and al ows the 
systems engineer to access the knowledge 01 the 
operation of the DFCS. Further enhancing such a 
system (level 4) would permit the monitoring 
system to automatically recommend and justify 
corrective action. Level 5 evaluates the health 
and status of the DFCS and reconfigures the 
control system automatically to accommodate this 
evaluation. The body of this paper presents the 
design and development of a level 3 system that 
can be developed to level 4. An expert-system 
flight status monitor is being developed that will 
Inform the systems engineers of the FCS problems 
and determine their cause; this expert will recom- 
mend corrective action and generate appropriate 
procedures for normal and emergency operation. 

Motivation *or Expert-System 
F light Status Monitor 

During flight testing of new and complex 
DFCSs, problems have occurred ’.hat the systems 
engineer has attempted to solve in real time, 
not always successfully. The resolution to the 
problems is often discovered after several days 
of studying the documentation, after which the 
engineers realize that they had known the solu- 
tion but had not applied it to this situation. 
Another situation that often occurs Is that a 
flight is aborted or a mission cancelled because 
of a detected problem; It may later be determined 
that the problem was negligible or not as severe 
as first thought, and the flight could have been 
shifted to another mission, accommodating the 
failure. At the Dryden Flight Research Facility 
of NASA's Ames Research Center both situations 
have occurred, costing both time and money. Three 
examples of situations that have occurred at Ames- 
Dryden are Included to Illustrate the need for an 
improved method of DFCS monitoring. 

H1HAT Gear-Up Landing 

The NASA HI MAT remotely piloted vehicle was 
a highly successful program with only a few In- 
flight problems, one of which Is discussed here. 
The HI MAT was performing a normal mission when It 
lost one of two uplink reclevers used to accept 
comtands transmitted from the ground station. The 
HI MAT was flown remotely by a pilot in a ground 
cockpit, with commands transmitted to receivers on 
the aircraft and aircraft feedbacks transmitted to 
ground computers. A cockpit switch signaled the 
control system computer to deploy the gear, and 
the control system translated the command Into a 
cycled signal understood by the HI MAT. The TF-104 
chase crew member controlled a backup gear deploy- 
ment switch that could be manually cycled, If 
necessary, to provide the correct signal to the 


aircraft. After the loss of one of the uplink 
receivers on board the H1MAT, the cockpit gear 
switch was activated, but the gear did not deploy. 
The correct sequencing requirement was remembered 
and correctly performed, but the gear stayed up, 
and the vehicle was landed (safely) on Its belly. 
The problem was Investigated after the flight; 
the systems engineers ultimately realized that 
the loss of one uplink receiver changed the com- 
mand persistence requirement for the gear-down 
sequencing. Knowledge of the sequencing and per- 
sistence requirement for cycling the gear switch 
was available, but it was not recalled during the 
critical period and was not Included In the normal 
documentation. 

AFTI/F-16 Multiple Mode Change 

The AFTI/F-16 aircraft Includes a complex 
avionics suite. Including a stores management 
set (SMS) and fire control computer (FCC) along 
with a complex triplex DFCS, all of which com- 
municate on an IEEE 1553 data bus, with the FCC 
acting as the primary bus controller and the SMS 
acting as backup bus controller. During the DFCS 
flight test phase, the AFTI/F-16 contained four 
standard modes, four decoupled modes, and multiple 
submodes. On an early flight the DFCS received 
multiple (over 300) uncommanded mode change re- 
quescs, which It then acted upon; this resulted In 
the aircraft experiencing multlp’e mode changes In 
a short time period. When this problem was 
detected on the ground through the flashing of 
mode lights, a solution was sought. Approximately 
5 min later the systems engineer had the pilot 
turn off the SMS, and the mode switching stopped. 
The four standard FCS modes and multiple submodes 
were all engaged through the SMS via the 1553 data 
bus with no protection built Into the DFCS to pre- 
vent multiple mode switching In a short period of 
time. In the stressful environment of an early 
flight on an unusual and complex flight control 
system In an urgent situation, the systems 
engineer could not readily recall the critical 
knowledge and required more than 5 min to deter- 
mine the appropriate action. 

AFTI/F-16 Flight Control System 
Failure Indication 

Each channel In the triplex DFCS of the 
AFTI/F-16 aircraft Is capable of determining 
Its own status and health, as well as that of 
the other channels, and then transmitting that 
Information to both the pilot and the ground 
monitoring station. At the same time, failures 
on the DFCS are divided Into several subcomponents 
and levels, making It difficult to determine the 
actual operating state of the system. The fail- 
ures are displayed to the pilot and ground station 
In a numeric code that Indicates each channel's 
diagnosis of the problem and the element that has 
failed. During an envelope-expansion flight, an 
onboard failure of the FCS caused each channel to 
establish a different failure state and to provide 
conflicting Information to the pilot. The systems 
engineer had to decipher the fault codes generated 
by each channel for all components, determine 
the failure condition, and recommend a corrective 
action, all within minutes. The recommended 
action was to reset the FCS, hoping that the 
situation would improve without a complete under- 
standing of the condition of toe system. The 
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reset caused further degradation of the system, 
forcing the actuator to select the backup hydraulic 
system. The aircraft remained controllable and 
landed safely due to the redundancy built Into 
the DFCS. The systems engineers spent several 
hours after the flight determining what the fault 
codes meant, and several days elapsed before they 
understood the problem along with Its cause (an 
Internal software switch had Induced different 
states Into each of the three flight control 
channels, causing each channel to develop a dif- 
ferent view of the aircraft and system state). 

The three problems just described are only 
a sampling of problems that occur during the 
flight testing of new, advanced, complex systems. 
Even with the best design process, not all con- 
tingencies are covered. Information may be dis- 
covered too late In the design and test cycle 
to be Incorporated Immediately, and It must be 
carried as part of the system knowledge until 
It can be Included In the design. The system 
complexity also requires a great deal of system 
knowledge simply to monitor the system within 
normal operations. At Ames-Dryden, an expert 
system Is being developed to help solve these 
problems. An expert system would contain the 
knowledge (which the systems engineers so labor- 
iously acquire) In an easily accessible form 
In the control room, which would reduce the time 
necessary to recall or rediscover the needed know- 
ledge. The same expert system would also be able 
to recommend the appropriate corrective action 
to more quickly reduce the hazard by using Its 
ability to draw on a larger data base than the 
systems engineer. The probable causes of the 
problem could be assessed by this expert system 
and relayed to both the systems engineer and the 
pilot for evaluation, which would again reduce 
the time required to develop a safe solution. 

Description of the Expert System 

A conceptual view of an expert-system flight 
status monitor Is shown In Fig. 3. The system 
must be able to receive Information on the status 
and health of the FCS from telemetry downlink data 
and translate this Information Into a usable for- 
mat. Conventional programs have been developed 
that receive -elemetered downlinked data and very 
rapidly translate them Into digital words. This 
Information could then be Input to the expert 
system. The expert system must then determine 
whether any changes have occurred compared with 
the previous sample and, If so, evaluate the effect 
of these changes. The expert-system flight stitus 
monitor must update Its knowledge base at a rate 
that is compatible with the aircraft downlinked 
data. A data-driven foreground loop will deter- 
mine the state of the system and Inform the user. 

In this case the systems engineer, of the changes 
and consequences. If a failure occurs, a warning 
or caution will be Issued along with corrective or 
emergency procedures. If required. As a part of 
this evaluation, the expert system may be required 
to ask the user questions on the state of the 
aircraft. A background task will allow the vser 
to query the monitor for Information on FCS state 
or the rationale the monitor used to reach Its 
conclusions. The expert system will Interrupt 


the background task when necessary to evaluate 
new data. If the state of the FCS has not changed 
between Inputs, the expert system will not re- 
evaluate that state. 

The knowledge base will contain both aircraft 
specific rules. 

If AC Power Is Failed 

Then Analog Reversion Mode 
Is Failed, 

and metarules, the rules that the systems engineer 
uses to determine the correct action for a failure 
situation. 

If All Downlink Data Is Failed 

Then There Was A Telemetry 

Spike. 

The knowledge base will also contain rules to 
allow the expert system to determine the air- 
craft state and the required corrective action 
and to Inform the systems engineer of its eval- 
uation. The expert system will consist of rules 
to emulate the failure detection system of the FCS 
and compare the state It generates to that of the 
aircraft. If the monitor's conclusions disagree 
with the aircraft state, a warning will be Issued 
and the user will be able to ask the expert system 
to resolve this conflict. The conflict resolution 
will be processed as part of the background task 
to allow the monitor to evaluate the aircraft 
Information as It Is generated. The ground-based 
expert system will also be able to communicate 
with the pilot by a remotely computed display 
driven from Information generated by the expert 
system and telemetered to the aircraft via the 
NASA Ames-Dryden uplink system. The ability to 
transmit the expert-system knowledge to a pilot 
display using ground computers will allow pilot 
Interaction without waiting for the development 
of flight-qualified systems and will allow the 
pilot to access much-needed Information In criti- 
cal situations without the delay of waiting for 
the Information from the ground station. A tech- 
nique will be developed to allow the pilot to 
respond to queries from the expert system for 
Information needed to determine the status of the 
aircraft. 

A major concern In the development of an 
expert-system flight status monitor Is the cap- 
ability of operating In real time, since the 
Information Is available to the expert system 
from the aircraft at speeds of 40 to 50 Hz and 
the amount of Information to be processed can be 
from a few words to over 100 bits of Information. 
The time available to analyze and develop recom- 
mendations when a problem occurs In the flight 
environment Is very short because the aircraft 
can lose control within seconds; consequently 
any expert system developed to assist In monitor- 
ing must be able to respond In seconds. Therefore, 
the real-time Issue Is of great concern and Is 
being explored. Different Inference techniques 
for real-time operation are being Investigated, 
along with the data, or rule, representations. 

The development of data structures that Improve 
the real-time Implementation and allow easy modl- 
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f 1 cat 1 on and adaptation to the knowledge base Is 
essential for an operational system. 

The ultimate goal In the development of an 
expert-system flight status monitor Is to demon- 
strate the capability of a real-time expert 
monitor providing "Intelligent" Interpretation 
of system status Information and to apply this 
monitor In the control room environment, the 
Western Aeronautical Test Range (WATR). The 
system will Initially be designed as a stand- 
alone system capable of evaluating simulation or 
flight tapes. Then the system will be Incorpor- 
ated Into the simulation environment for testing 
and evaluation. Installed In the control room, 
and later, extended to tne aircraft to allow the 
pilot direct Interface with some subset of the 
monitor. A small subset of a OFCS Is currently 
being used to develop the knowledge representa- 
tion and Inference mechanisms for a demonstration 
system, but the know. edge base will be expanded 
to Incorporate the full FCS as the expert system 
develops. The system will continue to expand, 
from a full description of the FCS to other systems 
on board the aircraft, until the expert-system 
flight status monitor cannot operate In real time. 
At this point, new computer hardware or software 
techniques will hopefully be available to allow 
the system to expand and operate In real time. 

Development Approach 

To address the development of an expert- 
system flight status monitor, Ames-Dryden systems 
engineers are developing an experimental system 
while an experienced contractor Is developing an 
operational system In cooperation with Ames-Dryden 
engineers. The In-house effort concentrates on 
developing experience In expert systems while a 
knowledge base is developed for the operational 
system. Various knowledge representations and 
new techniques will be Investigated prior to 
operational Implementation. The contractor's 
parallel effort Is directed toward developing 
an operational system using the aircraft-specific 
knowledge derived from In-house development, 
developing a working real-time system, and sharing 
proficiency In expert systems. 

The first developmental go . In the real-time 
system Is an operational demonstration system 
capable of processing simulation or flight data; 
such i, system will Improve the speed of processing 
failure Information after a flight and will Inter- 
act with the user to determine the FCS state. 

This system (to be developed by the contractor 
In association with Ames-Dryden engineers) will 
be an Interactive, non-real -time system that will 
demonstrate the rule base and Inference structure 
to be used on the real-time system. After the 
successful completion of the non-real -time expert- 
system flight status monitor, a real-time system 
based on the previously developed structure will 
be Implemented and Interfaced with a real-time 
hardware-ln-the-loop simulation of the aircraft. 

The simulation will provide real-time FCS data 
vis a data bus Interfaced with the expert-system 
flight status monitor. The simulation will be 
used to test the system In a real-time envlronrent 
and to provide necessary verification and valida- 


tion of the expert system prior to Its Implement- 
ation In the control room (Fig. 4). After verifi- 
cation and validation, the system will be Inter- 
faced to the downlinked data from the aircraft 
systems, through either the control room (WATR) 
or the remotely controlled vehicle and display 
(RCVD) simulation facility. Once an operational 
system has been developed, the knowledge base will 
be expanded until either the limit of the expert 
system Is reached or the aircraft systems have 
been completely defined. After an expert-system 
flight status monitor has been successfully demon- 
strated In the control room, the system will be 
extended to allow Interfacing with the pilot 
through the Ames-Dryden uplink system. A remotely 
controlled display, driven by the remotely com- 
puted display system, will be developed to Inter- 
face the expert system with the pilot. 

Status of Expert-System 
Flight Status Monitor 

In-house development of the expert-system 
flight status monitor has been underway since 
November 1984, and a working non-real-time system 
has been demonstrated on a multiuser VAX 11/750 
In Common LISP. The knowledge base currently 
Includes only the Input sensors for the aircraft 
and their respective status and mode Indications 
(Fig. 5). Input sensors include roll rate, pitch 
rate, yaw rate, pitch stick command, roll stick 
command, yaw pedal command, actuator position 
feedbacks, normal accelerometer, lateral acceler- 
ometer, air data, and power Interfaces. The FCS 
used for the demonstration (Fig. 6) Is a triplex 
configuration with both Input and output voting. 

It features a triplex Independent backup system 
that Is dissimilar to the primary system and digi- 
tal channels capable of Independently switch from 
the primary to the backup system. The actuators 
used also contain a voting plane, but they were 
not Included In the current expert-system flight 
status monitor. The hierarchy, or relationship 
of each element to the others (Fig. 5), Is 
Included In the expert system at a level at 
wh ch only the direct Interrelationship Is 
Included, with no Interpretation given. This 
allows the monitor Itself to develop the tree- 
like Interrelationships, thereby eliminating the 
human error of missing an Interface or inputting 
an Incorrect interface. 

Improved knowledge representation Is currently 
under development to allow for a more effective 
system. A knowledge acquisition tool has been 
developed to allow easy user Interaction and 
Improved aircraft rule acquisition. The opera- 
tional demonstration system (jointly developed 
by Ames-Dryden and the contractor) Is to be com- 
pleted by early fall 1985 (Fig. 7). With the 
demonstration of the feasibility of tnls system, 
development of the real-time system will begin 
by mld-1986, and an operational real-time expert- 
system flight status monitor will then be inter- 
faced with the aircraft telemetry downlink data 
and evaluated by the systems engineers. The 
Interface of the expert system to the aircraft 
crew station Is not scheduled until 1987, and 
knowledge base development Is expected to continue 
uninterrupted. 
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Conclu ding Remar ks 

The application of expert systems to flight 
test monitoring is particularly appropriate. 

The monitoring task is manpower and information 
intensive anu is fairly well understood. The 
capabilities of a system to monitor data down- 
linked from the flight test aircr t and to 
generate information on the state and health 
of the system for the monitoring engineers will 
provide increased safety du 1 ng flight testing 
of new systems. The expert system will provide 
the systems engineers with ready access to the 
large amount of information required to describe 
a c iplex aircraft system; access to this infor- 
mation in an easily understood form will enhance 
engineering capabilities in understanding and 
developing future complex systems. The poten- 
tial power of such a system, originating from 
the beginning of a development program, is 
enormous. As both the expert system and the 
aircraft system are developed, discrepancies can 
be resolved prior to the actual testing of the 
aircraft system. The expert system can be main- 


tained at the same rate as the aircraft system, 
providing easy, user-friendly knowledge storage. 
The expert system can be integrated with the simu- 
lation prior to flight testing; anomalies that 
occur in the simulation can be better understood 
in real time without wasting hours of simulation 
time. As new Information about the aircraft 
system is discovered, the expert system can be 
updated to contain the most complete knowledge 
available. 

A demonstration system has been developed 
that, although not operating in real time, shows 
great promise for the use of expert systems in 
the flight test environment. The development of 
an expert system has been helpful in defining 
the operation of the FCS. Even though the know- 
ledge base is limited, the development of the 
demonstration system generateu new engineering 
knowledge that contributes to the effectiveness 
of *he engineers and to program safety. The cen- 
tral location of the knowledge base is another 
useful byproduct of this development. 



AFTI/F-lll advanced bring control 
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Fig. 1 Typical Amee-Dryden aircraft brith advanced control eyeteme. 




5 



Level 5 - Expert Reconflgurable System 

Evaluates system and reconfigures It to 
accommodate system atatua 


Level 4 

- Expert Interpretation and 
Recommendations 

Reconfiguration racommandatlona 


1 



Level 3 - Expert Interpretation 

Syatam to provide and uaa 
available Information 

■ 

Expert flight 
system monitor 




Level 2 - Some Interpretation 

Logical operations on 
avallabla Information 

AFTl/F-18 
X 29A 






Level 1 - No Interpretation 
Pura display of limited 
available Information 

HIMAT 





Fig. 2 Laval* of flight monitoring automation. 
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